What this covers:
Mid Florida Dermatology & Plastic Surgery, an Orlando-based practice with 33 offices across central Florida, is notifying patients after a cyberattack exposed personal, financial and medical records. The practice reported the incident to the US Department of Health and Human Services on May 1, 2026 as affecting roughly 85,585 people.
The Florida dermatology data breach is a healthcare story, but the mechanics are not specific to healthcare. Patient data sits on a network server, nobody watches it closely enough, and the first public signal comes from a criminal group rather than the practice.
Here is what the practice and federal records confirm, what the ransomware group claims, and what the timeline says about detection, notification and the six-month gap in between.
What the Florida Dermatology Data Breach Exposed
The exposed information varies by person. According to the practice’s notice and the federal filing, it may include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, Medicare numbers and other government identification numbers.
It may also include financial account numbers and account access information, health insurance details and medical information. That combination, identity data plus financial access plus health records, is the most useful set an identity thief can hold, because it supports both credit fraud and medical billing fraud at the same time.
The practice says it is mailing notice letters to affected patients, and that anyone who does not receive one can call its assistance line at 1-877-344-1677 to check whether they were impacted. It is also urging patients to review account statements, explanation of benefits forms and credit reports for activity they cannot place.
How the Florida dermatology data breach Unfolded
The dates in the Florida dermatology data breach are the part worth studying, because they describe how long a breach actually takes to work through:
- March 26 to March 30, 2026 — an unauthorized party gained access to the practice’s systems and, per the investigation, may have copied information.
- March 30, 2026 — the practice spotted unusual activity, began an investigation and retained outside experts.
- April 25, 2026 — the Qilin ransomware group publicly claimed responsibility, posting on a dark web site that it had obtained the organization’s data.
- May 1, 2026 — the practice reported the incident to HHS as a hacking/IT incident involving a network server, listing 85,585 individuals.
- August 31, 2026 — the practice says it finished reviewing the affected files to determine what data was involved and whose it was.
- September 10, 2026 — the practice published its public notice. Notice letters followed.
Read that sequence as a business, not as a patient. The intrusion took four days. Confirming what was in the stolen files took five months. The public knew a name before the practice could say what had been taken, because a criminal group announced it first.
The Qilin Claim, and What It Means
The Qilin claim sitting behind the Florida dermatology data breach is a claim by a criminal group. It is not the practice’s confirmation, and it is not a finding by any agency. What is confirmed is the federal filing and the practice’s own notice; what comes from the group is that it holds the data.
That distinction matters when a listing appears, because ransomware groups increasingly name victims before any investigation is finished and sometimes before the victim public says anything at all. If a vendor you depend on appears on a leak site, the group’s post is a reason to ask hard questions, not a source of facts about your exposure.
Qilin has been one of the more prolific groups targeting healthcare organizations in 2025 and 2026, which is consistent with the pattern here: healthcare records carry more resale value per record than most other data, because insurance and billing details can be used long after a credit card is cancelled.
What the Florida Dermatology Data Breach Means for Every Practice
Three things stand out in the Florida dermatology data breach, and none of them require a hospital budget to act on.
1. One network server carried the whole risk. The federal filing describes a hacking incident involving a network server. In most practices, that server holds the imaging system, the billing export, or a shared drive with scanned IDs. Nobody owns it, and it sits outside the systems the practice thinks of as “the medical records system”.
2. Thirty-three offices, one incident. A multi-site practice concentrates records centrally to make billing and scheduling work. The same consolidation means a single compromised account reaches every location. Our rundown of cybersecurity threats facing medical offices covers the access paths that get used first.
3. Patients become targets twice. The practice is now mailing notices, which is exactly the moment when fake notices arrive. Patients who expect a letter from a dermatology group are more likely to trust an email that says it is one. Any practice sending breach notices should warn patients, in the same communication, that the notice comes by mail and that no one will call asking for a Social Security number.
6 Lessons From the Florida Dermatology Data Breach
1. Detection is not containment. The practice spotted the activity on March 30. The access began March 26. Four days is a normal gap, and it is why logging and alerting on file access matter more than antivirus signatures.
2. Inventory the data you did not think you had. The review took five months because the practice had to work out what was in the affected files. A data map, written before an incident, turns that five months into days.
3. Know the notification clock. Federal rules require breach notification within 60 days of discovery for covered entities. The filing went in on May 1, well inside that window, and the patient notices still went out much later, because the data review was not finished.
4. Assume the leak site will speak first. Qilin posted five days before the federal filing. Plan the holding statement, the call center and the patient FAQ before you need them.
5. Vendor exposure is your exposure. Billing services, transcription, imaging and IT support all touch this data. We covered that chain in what a third-party breach costs the vendor you trust.
6. The patient-facing steps are cheap and they work. Credit freezes with all three bureaus, fraud alerts, statement and explanation-of-benefits review, and two-factor authentication on email and financial accounts. Suggest them in the notice rather than leaving patients to search.
Beyond the Florida dermatology data breach, one question settles it: if you cannot answer “which server holds scanned patient IDs, and who has access to it” in one sentence, that is the finding to fix this quarter. A cybersecurity services review starts there.
Florida Dermatology Data Breach FAQ
Who was affected by the Florida dermatology data breach? Patients of Mid Florida Dermatology & Plastic Surgery, which operates 33 offices across central Florida. The practice reported approximately 85,585 affected individuals to HHS on May 1, 2026.
What data was involved? Names, addresses, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, Medicare numbers, other government IDs, financial account numbers and access information, health insurance information and medical information.
Did Qilin really attack the practice? Qilin claimed responsibility on April 25, 2026 in a dark web post. That is the group’s claim. What is confirmed is the practice’s data review and the federal breach filing.
I am a patient and got no letter. What should I do? Call the practice’s assistance line at 1-877-344-1677 to confirm whether you were impacted, and treat any email or text claiming to be the notice as suspicious until you have verified it directly.
Why did notification take so long? The practice says it finished reviewing the affected files on August 31, 2026, five months after the March 30 discovery. The federal filing itself came on May 1, within the 60-day window.
What should a business take from this? That the expensive part of a breach is often the data review, not the intrusion, and that a written data map plus alerting on file access is what shortens it.
Sources: The Daily Hodl’s October 17, 2026 report; Claim Depot’s summary of the practice’s notice and federal filing; the practice’s public notice dated September 10, 2026; and the HHS Office for Civil Rights breach portal. The Qilin attribution is the group’s own claim.
Do you know where your patient or client records actually live? Contact Nextek IT to book a call and we will map the systems that hold sensitive records, and who can reach them.